ASSIGNED 284185
Webauthn authentication fails with CTAP1/U2F 
https://bugs.webkit.org/show_bug.cgi?id=284185
Summary Webauthn authentication fails with CTAP1/U2F
will.smart
Reported 2024-12-06 12:54:42 PST
On the Safari 18.2 release candidate on MacOS and iOS, Webauthn authentication ceremonies fail if all of the following conditions are met: * The user is attempting to fulfil the webauthn authentication request with a FIDO security key * CTAP2 is unavailable, and communication with the security key must take place over CTAP1 (U2F), such as on YubiKey 4 and earlier models, or Yubikey 5 series and later with FIDO2 disabled. * The Relying Party ID (RPID) of the webauthn request is sufficiently long, or has more than two parts, such as demo.yubico.com. Note that short, two part RPID’s like webauthn.io deem to be unaffected. * The webauthn request sets user verification to “discouraged” This has the potential to affect any relying party that uses webauthn as a second factor, with users that are still using U2F devices. It will not affect relying parties that require user verification, because those situations are already incompatible with CTAP1/U2F. Steps to reproduce: 1. Find a U2F device, or configure a YubiKey with FIDO2 disabled, and U2F enabled 2. Go to https://demo.yubico.com/webauthn-developers 3. create a new credential with the default settings (attachment unspecified, residentKey discouraged, userVerification preferred, attestation direct) 4. attempt to authenticate (assert) with the credential that was just made, with userVerification set to discouraged Expected Behavior: The security key is usable to satisfy the webauthn request Observed Behavior: The browser does not react to inserting/tapping the security key or the user presence gesture. Affected security keys: * Any security key where U2F / CTAP1 is the only supported protocol. Verified on the YubiKey 4, YubiKey 5 and the Google Titan v1
Attachments
Add attachment proposed patch, testcase, etc.
Radar WebKit Bug Importer
Comment 1 2024-12-13 12:55:16 PST
<rdar://problem/141455105>
John Wilander
Comment 2 2024-12-16 10:42:03 PST
Thanks for filing! This is a duplicate of rdar://140380303 which is likely fixed by rdar://141169679.
will.smart
Comment 3 2024-12-23 11:38:20 PST
We were still able to reproduce this issue with the latest MacOS beta 24D5034.
will.smart
Comment 4 2025-01-13 12:47:07 PST
This appears to be resolved in the the latest MacOS (24D5040f) and iOS (22D5040d) Betas.
Note You need to log in before you can comment on or make changes to this bug.